Projects sharing features with MemProcFS

Loki is an endpoint detection tool, forensic artifact analyzer, and threat intelligence scanner. It functions as a YARA-based indicator of compromise scanner designed to identify malicious persistence mechanisms, web shells, and unauthorized administration tools across local and remote systems. The project distinguishes itself by integrating multi-source threat intelligence, allowing for the loading of custom signature sets and encrypted indicators. It combines hash-based artifact detection with YARA rule execution to scan files, process memory, and registry hives for known malicious byte seq

Volatility is a memory forensics framework and digital forensics tool designed to extract and analyze evidence from volatile computer memory dumps. It functions as a memory dump parser and analysis platform used to identify running processes, network connections, and loaded modules from a system RAM capture. The framework enables the reconstruction of system state to uncover malicious activity, such as rootkits and injected code, during malware incident response and threat hunting. It provides capabilities for digital forensic investigations to detect unauthorized access and indicators of com

The diagnostics project provides a cross-platform diagnostic infrastructure and command-line toolkit for monitoring runtime performance, analyzing memory dumps, and troubleshooting applications. It features a custom inter-process communication protocol for command and telemetry exchange across platforms, a low-overhead event pipe mechanism for streaming real-time diagnostic events and performance counters from running processes, and automated remote symbol resolution for stack trace analysis. The platform includes native debugger extensions that integrate with standard debuggers to inspect ma

HyperDbg is a hardware-assisted kernel-mode debugging platform that leverages virtualization to monitor and control system execution. By utilizing hypervisor-level primitives, it enables deep system analysis and instrumentation without relying on standard operating system debugging interfaces. The framework provides a comprehensive environment for inspecting both kernel and user-mode processes, allowing for granular control over execution flow and system state. The project distinguishes itself through a transparent debugging layer designed to remain invisible to the target environment. It emp

This project is a Python command-line security tool and malware analysis framework designed for threat intelligence aggregation and incident triage. It functions as an aggregator that orchestrates queries across multiple security services and sandboxes to analyze hashes, IP addresses, and domains. The tool distinguishes itself by incorporating an intelligence layer that uses language models to provide automated risk assessments and framework mappings. It also includes specialized capabilities for extracting indicators of compromise from unstructured text, documents, and web pages, as well as

This project is an open-source intelligence reconnaissance framework and recursive attack surface mapper. It functions as a containerized security scanner designed to map public-facing infrastructure, perform subdomain enumeration, and automate the gathering of open-source intelligence. The system employs a recursive discovery engine to iteratively explore target infrastructure, utilizing a plugin-based module architecture to extend scanning capabilities. It integrates third-party APIs for data enrichment and applies YARA rules across discovered assets to identify specific vulnerability patte

pe-sieve is a set of diagnostic tools for scanning Windows process memory to identify malicious implants, shellcode, and hooks. It functions as an in-memory implant detector, malware unpacker, and process callstack analyzer designed to locate and dump memory patches and injected code from running processes. The project identifies advanced evasion techniques, such as process hollowing and reflective injection, by verifying portable executable structures in memory. It distinguishes itself by analyzing process callstacks to detect anomalies and redirections and by reconstructing executable heade

frida-dexdump is an Android memory forensics tool that recovers Dalvik Executable (DEX) files from running application processes using the Frida dynamic instrumentation framework. It functions as a Frida-based runtime analyzer and DEX memory dumper, capable of extracting obfuscated or packed DEX files without modifying the Android system. The tool distinguishes itself through its ability to repair corrupted or missing DEX file headers using heuristic analysis and fuzzy matching techniques. It employs fuzzy boundary detection to identify DEX file boundaries in memory even when headers are dama

Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network vulnerability scanning, open-source intelligence, penetration testing, and social engineering. It functions as a multi-purpose framework for automating reconnaissance and executing security audits across diverse network environments. The project features a specialized phishing and social engineering toolkit used for cloning websites, masking URLs, and deploying deceptive pages to capture user credentials. It also includes a remote access Trojan builder for generating platform-specific exe

MimiPenguin is a Linux memory credential extractor and password recovery tool designed to isolate and retrieve cleartext user login passwords from active process memory. It functions as a post-exploitation utility for extracting sensitive credentials from desktop user sessions during security assessments. The tool performs Linux memory forensics by analyzing system process memory to identify and isolate credentials. It is used for security penetration testing and evaluating risks associated with memory-based attacks, as well as testing for local privilege escalation. The system targets user-

sql.js-httpvfs is a virtual file system and loader designed to execute SQL queries against read-only SQLite databases hosted on remote static file servers. It enables the retrieval of database files over HTTP without requiring the entire file to be downloaded to the client. The project distinguishes itself by using byte-range HTTP fetching to simulate local random-access reads. It includes a chunking tool that splits large databases into smaller pieces via a JSON configuration, which helps bypass file size limits and optimizes caching. The system covers a range of capabilities including remo

Samply is a cross-platform CPU sampling profiler and performance analysis utility. It consists of a command-line tool for recording process stack traces at regular intervals and a visual interface for analyzing the resulting execution data. The system includes a debug symbol resolver that maps raw memory addresses to human-readable function names using local or remote symbol information. It transforms recorded execution data into flame graphs and timelines to pinpoint function-level hotspots. The tool provides capabilities for CPU execution recording, stack unwinding, and symbol resolution a

GVFS is a virtual file system and performance optimizer designed to manage enterprise-scale Git repositories. It provides a virtualization layer that allows large remote repositories to be treated as local directories by retrieving file contents from a server only when they are accessed. The system optimizes version control operations by limiting the scope of active file objects and downloading specific data on demand rather than cloning the entire repository history locally. This approach reduces initial setup time and minimizes local disk usage. The project implements a workflow based on o

pifs is a mathematical constant filesystem and data-free storage simulator. It emulates a virtual filesystem by mapping file data to digit sequences within infinite mathematical constants to eliminate the need for physical disk storage. The system functions as an experimental file mapping tool that converts file content into coordinates and offsets within a numerical constant. It utilizes a virtual metadata manager to track file lengths and positions, allowing for data retrieval without traditional storage blocks. The project covers experimental storage architecture through the use of formul

Hotspot is a graphical user interface for analyzing and visualizing performance data captured by the Linux perf tool. It functions as a performance profiling visualizer and assembly-level profiler that maps performance costs to specific instructions synchronized with original source code. The project distinguishes itself through a remote symbol resolver that maps performance data from embedded targets to local host debug symbols and sysroots. It also includes a specialized off-CPU analysis tool designed to identify thread wait times and I/O blocks using kernel scheduler tracepoints. The tool

hfs is a web-based file server and HTTP file hosting platform that shares local files and folders with remote users through a web browser. It functions as a media streaming server for audio and video content and provides a virtual file system to organize shared web paths independently of the physical disk hierarchy. The platform includes a remote file administrator for monitoring active transfers and managing server settings via secure authentication. It allows for the hosting of static websites and private content with access restrictions based on user accounts or geographic location. The s

backward-cpp is a C++ stack trace library and debugging utility designed to capture, resolve, and print detailed execution traces and crash reports. It functions as a crash reporter and call stack printer that translates raw memory addresses into human-readable function names, filenames, and line numbers. The project provides automated crash reporting by registering system handlers for fatal errors, such as segmentation faults, to automatically generate execution traces upon program failure. It distinguishes itself by extracting source file fragments from disk to display specific lines of cod

Cyberduck is a multi-protocol file transfer client and cross-platform file manager for Mac and Windows. It functions as a cloud storage manager and remote storage mounter, allowing users to upload, organize, and synchronize data between local drives and remote endpoints. The application provides a unified interface for managing files across FTP, SFTP, WebDAV, S3, and other cloud storage protocols, including Amazon S3, Backblaze B2, Microsoft Azure, and OneDrive. It distinguishes itself with a client-side encryption vault that encrypts files and folders locally before they are transmitted to r

Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments. It functions as a security policy manager, observability agent, and enforcement engine that hooks into kernel functions and tracepoints to detect privilege escalation, container escapes, and unauthorized system activity. The project distinguishes itself through its ability to perform real-time, in-kernel enforcement, allowing it to synchronously terminate malicious processes or modify function return values before a system call completes. It provides deep Kubernetes integration

WebGLStudio.js is a browser-based IDE and graphics editor for creating 3D scenes, textures, and animations using WebGL. It functions as a spatial design environment where users can arrange 3D meshes and assets directly within the browser to build interactive visual experiences. The project features a visual shader graph editor that allows for the development of custom rendering effects and post-processing shaders through a node-based interface. It also includes a virtual file system for organizing 3D models, audio, and textures, and uses URL-state serialization to share entire project configu

Seer is a graphical frontend for GDB that provides a visual interface for inspecting variables, managing breakpoints, and stepping through code. It functions as a low-level debugger visualizer with specialized tools for call stack inspection and register visualization. The project distinguishes itself by integrating low-level program analysis directly into the visual experience, featuring a synchronized assembly overlay that maps CPU registers and assembly instructions to source code lines. It also includes memory bug detection capabilities by randomizing the program starting address during t

code-server is a browser-based integrated development environment that allows a VS Code compatible editor to run on a remote server. It functions as a self-hosted code editor, enabling users to access a persistent development workspace from any web browser without requiring local software installation. The project focuses on remote development environment hosting, moving heavy compilation and processing tasks to remote hardware to offload resources. This architecture enables cloud development environments that standardize workspaces and preserve local battery life by shifting computation to a

Bloaty is a binary size profiler and executable format analyzer that attributes every byte of a binary to specific symbols or compile units. It functions as a compilation unit profiler and C++ symbol demangler, mapping binary size back to source files and translating mangled names into human-readable formats. The project distinguishes itself as a binary diffing tool capable of comparing two versions of a binary to isolate specific symbols or sections responsible for size regressions. It provides specialized support for recovering symbols in stripped binaries by associating them with external

Alluxio is a virtual distributed file system and data orchestration layer that serves as a high-performance caching layer between cloud storage and compute clusters. It acts as a distributed data cache designed to accelerate data access for large-scale analytics and machine learning workloads. The system provides a unified interface that presents multiple heterogeneous storage backends as a single coherent namespace. This allows for the unification of diverse storage systems, enabling computation engines to access data from different providers without changing application code. The project c

Parca is an always-on continuous profiling platform that captures CPU and memory usage from running applications without any code modifications. It uses eBPF kernel-level tracing to automatically discover and sample stack traces across infrastructure, and provides a web-based flame graph dashboard for interactive performance analysis. Its label-based query engine lets users slice and aggregate profiling data across dimensions such as service, container, or region, using a Prometheus-style selector syntax. Unlike basic profilers, Parca stores profile samples in a columnar format using Apache A

Alist is a unified cloud storage gateway that aggregates disparate remote storage providers into a single, navigable virtual file system. By acting as a remote file system proxy, it decouples file operations from specific provider implementations, allowing users to browse, download, and manage files across heterogeneous backends through a standardized interface. The platform utilizes a driver-based storage abstraction that translates generic file system operations into provider-specific API calls. This architecture supports a wide range of cloud storage services, S3-compatible object storage,